@posthog/wizard 2.79.0 → 2.80.0

package/dist/{setup-utils-dCViCC6s.js → project-data-BO9IXn9y.js}

@@ -1,603 +1,113 @@
-import { t as __exportAll } from "./rolldown-runtime-B_-DWIq7.js";
-import { s as logToFile } from "./debug-Cj-8vfXY.js";
-import { n as MCP_LOCAL_URL } from "./local-dev-McsurOC-.js";
-import { B as WIZARD_CONTACT_EMAIL, C as ISSUES_URL, E as OAUTH_TIMEOUT_MS, J as WIZARD_PROVISIONING_SCOPES, N as POSTHOG_PROXY_CLIENT_ID, O as POSTHOG_DEV_CLIENT_ID, P as POSTHOG_STATUS_PAGE_URL, Q as WIZARD_USER_AGENT, T as OAUTH_PORTS, W as WIZARD_OAUTH_SCOPES, d as DUMMY_PROJECT_API_KEY } from "./constants-CuJfQEcC.js";
-import "./wizard-session-2w4Ru-Wz.js";
-import { n as analytics } from "./analytics-VRYdebXW.js";
-import { i as withUtm, n as openTrackedLink, t as withProgress } from "./telemetry-Bpv-Mh5B.js";
-import { r as readFileHead } from "./bounded-fs-Cpn129A4.js";
-import { t as getUI } from "./ui-CGXtC7Vn.js";
-import { a as detectRegion, d as resolveBaseUrl, l as getOAuthUrl, n as provisionNewAccount, o as getCloudUrl, s as getHost, t as ProvisionedAccountUnreadableError, u as getUiHostFromHost } from "./provisioning-Zf7yPcEs.js";
-import { i as fetchProjectData, o as fetchUserData } from "./api-DGuJTzjr.js";
-import { i as wizardAbort } from "./wizard-abort-HDbP3YcS.js";
-import { major, minVersion } from "semver";
-import * as fs$2 from "fs";
-import * as path$2 from "path";
-import { basename, join as join$1 } from "node:path";
-import * as childProcess from "node:child_process";
+import { s as logToFile } from "./debug-DyARf5TF.js";
+import { B as WIZARD_CONTACT_EMAIL, C as ISSUES_URL, E as OAUTH_TIMEOUT_MS, J as WIZARD_PROVISIONING_SCOPES, N as POSTHOG_PROXY_CLIENT_ID, O as POSTHOG_DEV_CLIENT_ID, P as POSTHOG_STATUS_PAGE_URL, Q as WIZARD_USER_AGENT, T as OAUTH_PORTS, W as WIZARD_OAUTH_SCOPES, d as DUMMY_PROJECT_API_KEY } from "./constants-DO4X70po.js";
+import "./wizard-session-BYw6LzpS.js";
+import { n as analytics } from "./analytics-B6q5PN7a.js";
+import { r as withUtm, t as openTrackedLink } from "./links-9LWZPSCq.js";
+import { t as withProgress } from "./telemetry-BNKsDxNS.js";
+import { n as detectOrgAndProject, t as abort } from "./setup-utils-ChXXTi1m.js";
+import { t as getUI } from "./ui-tPNpM6vj.js";
+import { r as wizardAbort } from "./wizard-abort-DBKtfnBR.js";
+import { a as getOAuthUrl, s as resolveBaseUrl } from "./urls-BI4kJ4qQ.js";
+import { t as HostResolution } from "./host-resolution-DVSb7kXb.js";
+import { n as provisionNewAccount, t as ProvisionedAccountUnreadableError } from "./provisioning-CLhuKqXH.js";
+import { c as fetchUserData, o as fetchProjectData } from "./api-C3Dc4LFl.js";
 import { execSync } from "node:child_process";
-import * as fs$1 from "node:fs";
 import axios from "axios";
 import * as crypto from "node:crypto";
-import * as http from "node:http";
 import { z } from "zod";
-//#region src/shared/utils/package-manager.ts
-function hasLockfile(installDir, file) {
-	return fs$2.existsSync(path$2.join(installDir, file));
-}
-function lockfileHeaderContains(installDir, file, needle) {
-	return readFileHead(path$2.join(installDir, file), 500)?.includes(needle) ?? false;
-}
-async function writeOverride(slot, pkgName, pkgVersion, { installDir }) {
-	const pkg = await getPackageDotJson({ installDir });
-	let next;
-	if (slot === "yarn") next = {
-		...pkg,
-		resolutions: {
-			...pkg.resolutions ?? {},
-			[pkgName]: pkgVersion
-		}
-	};
-	else if (slot === "pnpm") next = {
-		...pkg,
-		pnpm: {
-			...pkg.pnpm ?? {},
-			overrides: {
-				...pkg.pnpm?.overrides ?? {},
-				[pkgName]: pkgVersion
-			}
-		}
-	};
-	else next = {
-		...pkg,
-		overrides: {
-			...pkg.overrides ?? {},
-			[pkgName]: pkgVersion
-		}
-	};
-	await updatePackageDotJson(next, { installDir });
-}
-const packageManagers = [
-	{
-		name: "bun",
-		label: "Bun",
-		installCommand: "bun add",
-		buildCommand: "bun run build",
-		runScriptCommand: "bun run",
-		flags: "",
-		detect: ({ installDir }) => hasLockfile(installDir, "bun.lockb") || hasLockfile(installDir, "bun.lock"),
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("npm", pkgName, pkgVersion, opts)
-	},
-	{
-		name: "yarn",
-		label: "Yarn V1",
-		installCommand: "yarn add",
-		buildCommand: "yarn build",
-		runScriptCommand: "yarn",
-		flags: "--ignore-workspace-root-check",
-		detect: ({ installDir }) => lockfileHeaderContains(installDir, "yarn.lock", "yarn lockfile v1"),
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("yarn", pkgName, pkgVersion, opts)
-	},
-	{
-		name: "yarn",
-		label: "Yarn V2/3/4",
-		installCommand: "yarn add",
-		buildCommand: "yarn build",
-		runScriptCommand: "yarn",
-		flags: "",
-		detect: ({ installDir }) => lockfileHeaderContains(installDir, "yarn.lock", "__metadata"),
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("yarn", pkgName, pkgVersion, opts)
-	},
-	{
-		name: "pnpm",
-		label: "pnpm",
-		installCommand: "pnpm add",
-		buildCommand: "pnpm build",
-		runScriptCommand: "pnpm",
-		flags: "--ignore-workspace-root-check",
-		detect: ({ installDir }) => hasLockfile(installDir, "pnpm-lock.yaml"),
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("pnpm", pkgName, pkgVersion, opts)
-	},
-	{
-		name: "npm",
-		label: "npm",
-		installCommand: "npm add",
-		buildCommand: "npm run build",
-		runScriptCommand: "npm run",
-		flags: "",
-		detect: ({ installDir }) => hasLockfile(installDir, "package-lock.json"),
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("npm", pkgName, pkgVersion, opts)
-	},
-	{
-		name: "expo",
-		label: "Expo",
-		installCommand: "npx expo install",
-		buildCommand: "npx expo build",
-		runScriptCommand: "npx expo run",
-		flags: "",
-		detect: () => false,
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("npm", pkgName, pkgVersion, opts)
-	}
-];
-function detectAllPackageManagers({ installDir }) {
-	return withProgress("detect-package-manager", () => {
-		const matches = packageManagers.filter((pm) => pm.detect({ installDir }));
-		if (matches.length === 0) analytics.setTag("package-manager", "not-detected");
-		return matches;
-	});
-}
-function serializeNodePM(pm) {
-	return {
-		name: pm.name,
-		label: pm.label,
-		installCommand: pm.installCommand,
-		runCommand: pm.runScriptCommand
-	};
-}
+import * as http from "node:http";
+//#region src/shared/utils/oauth-errors.ts
 /**
-* Detect Node.js package managers via lockfiles.
-* Wraps detectAllPackageManagers() above.
+* OAuth failure presentation — the structured error the flow throws and the
+* user-facing messaging built from it.
+*
+* `oauth.ts` owns the flow machinery (callback server, token exchange, port
+* retries); this module owns what a failure *means*: the RFC 6749 error
+* fields (`error`, `error_description`, `error_uri`), per-code remediation
+* copy, and safe rendering for the browser callback page. Everything here is
+* pure so the copy can be unit-tested without the HTTP machinery.
 */
-function detectNodePackageManagers(installDir) {
-	const detected = detectAllPackageManagers({ installDir }).map(serializeNodePM);
-	if (detected.length === 0) return Promise.resolve({
-		detected: [],
-		primary: null,
-		recommendation: "No lockfile found. Default to npm (npm add, npm run)."
-	});
-	const primary = detected[0];
-	return Promise.resolve({
-		detected,
-		primary,
-		recommendation: detected.length === 1 ? `Use ${primary.label} (${primary.installCommand}).` : `Multiple package managers detected. Prefer ${primary.label} (${primary.installCommand}).`
-	});
-}
-//#endregion
-//#region src/programs/oauth/program-scopes.ts
 /**
-* Extra scopes the MCP tutorial needs on top of `WIZARD_OAUTH_SCOPES`.
-*
-* Every scope requested here must stay within the wizard OAuth app's
-* ceiling on the PostHog side (`OAuthApplication.scopes`) — the full
-* list lives in the README under "OAuth app scope ceiling". The
-* tutorial's prompts and follow-ups touch most of the read surface,
-* plus annotation write for the "PostHog wizard install" verify-prompt.
+* A structured OAuth failure (RFC 6749 §4.1.2.1 authorize errors, §5.2 token
+* errors). Thrown by both the authorize callback and the token exchange so
+* the flow's error handler keys remediation copy and analytics fingerprints
+* off `code` instead of re-parsing `message`.
 *
-* Already in the base `WIZARD_OAUTH_SCOPES` (and therefore not
-* repeated here):
-*   • user:read, project:read, llm_gateway:read   — auth + gateway
-*   • query:read                                  — HogQL
-*   • dashboard:write, insight:write, notebook:write  — Phase-5 persist
+* The message stays exactly `OAuth error: <code>` — the analytics fingerprint
+* scheme (`wizard_oauth_<code>`) and the legacy message-prefix parsing both
+* depend on that shape. The description/uri ride along as properties.
 *
-* Deliberately omitted (writes on read-only product surfaces):
-*   • feature_flag:write, experiment:write, survey:write,
-*     cohort:write, session_recording:write, error_tracking:write,
-*     alert:write, subscription:write
+* NAMING: never bind an instance to a variable or property whose name
+* contains "oauth" (use `flowError`, `callbackError`, ...). CodeQL's
+* clear-text-logging heuristic classifies any `*oauth*`-named variable read
+* as password data, and these errors are deliberately shown to the user, so
+* such a binding flags every log statement downstream of it (CWE-312).
 */
-const MCP_TUTORIAL_SCOPE_ADDITIONS = [
-	"dashboard:read",
-	"insight:read",
-	"notebook:read",
-	"feature_flag:read",
-	"experiment:read",
-	"experiment_saved_metric:read",
-	"survey:read",
-	"session_recording:read",
-	"error_tracking:read",
-	"web_analytics:read",
-	"llm_analytics:read",
-	"cohort:read",
-	"person:read",
-	"annotation:read",
-	"annotation:write",
-	"activity_log:read",
-	"property_definition:read",
-	"event_definition:read",
-	"action:read",
-	"warehouse_table:read",
-	"warehouse_view:read",
-	"alert:read",
-	"subscription:read",
-	"integration:read"
-];
+var OAuthError = class extends Error {
+	code;
+	/** The server's human-readable explanation (`error_description`), if sent. */
+	description;
+	/** The server's "more info" link (`error_uri`), if sent. */
+	uri;
+	constructor(code, description, uri) {
+		super(`OAuth error: ${code}`);
+		this.name = "OAuthError";
+		this.code = code;
+		this.description = description;
+		this.uri = uri;
+	}
+};
 /**
-* Extra scopes the agent-skill program needs on top of `WIZARD_OAUTH_SCOPES`.
-*
-* Skills under this program (e.g. `creating-product-tours`) create feature
-* flags during the install flow. PostHog's consent grants exactly the scope
-* strings requested — `:write` does not imply `:read` — so listing existing
-* flags to avoid key collisions needs `feature_flag:read` explicitly.
-* `property_definition:read` lets the agent discover person properties when
-* building flag rollout filters instead of having to ask the user verbatim.
+* Sanitize an OAuth error param before logging or rendering it: these arrive
+* on a query string (or a token-endpoint body) that anything able to hit the
+* local callback port can populate. Strips non-printable/non-ASCII characters
+* and caps the length. Returns undefined when nothing printable remains.
 */
-const AGENT_SKILL_SCOPE_ADDITIONS = [
-	"feature_flag:read",
-	"feature_flag:write",
-	"property_definition:read"
-];
+function sanitizeOAuthParam(value, maxLength = 200) {
+	if (!value) return void 0;
+	return value.replace(/[^\x20-\x7e]/g, "").slice(0, maxLength).trim() || void 0;
+}
+/** Description sentences get more room than bare codes/URIs. */
+const MAX_DESCRIPTION_LENGTH = 500;
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+const OAuthErrorBodySchema = z.object({
+	error: z.string().min(1),
+	error_description: z.string().optional(),
+	error_uri: z.string().optional()
+});
 /**
-* Extra scopes the self-driving program needs on top of
-* `WIZARD_OAUTH_SCOPES`. All consumed by the PostHog MCP tools the
-* agent drives during the run:
-*   • task:read / task:write — the signal source config API
-*     (`inbox-source-configs-*`) is permissioned under the generic
-*     `task` scope object, NOT a signals-specific one. Unrelated to
-*     the Tasks product.
-*   • integration:read — `integrations-list`, to check whether the
-*     team already has a GitHub integration and to verify the connect
-*     flow completed.
-*   • signal_scout:read / signal_scout:write — list, sync, and tune
-*     the Signals scout troop (`signals-scout-config-*`).
-*   • session_recording:read / survey:read / error_tracking:read —
-*     server-side product-usage probes (`query-session-recordings-list`,
-*     `survey-list`, `error-issue-list`). Product usage is a
-*     project-level fact (often instrumented in another repo or via
-*     the snippet), so the agent asks the server instead of inferring
-*     only from the local setup report. All three are read-only and
-*     already in the wizard OAuth app's production scope ceiling (the
-*     mcp-tutorial program requests them).
-*   • external_data_source:read / external_data_source:write — the
-*     connected-tools step creates the GitHub Issues / Linear warehouse
-*     sources directly (`external-data-sources-create`) and verifies
-*     what's actually connected (`external-data-sources-list`) instead
-*     of taking the user's word for it.
-*   • llm_skill:read / llm_skill:write — the custom-scouts step
-*     (skill step 6b): read the seeded `authoring-signals-scouts`
-*     guide and canonical scout bodies (`llma-skill-get` /
-*     `llma-skill-file-get`) and author the user-approved custom
-*     `signals-scout-*` skills (`llma-skill-create`). Canonical scout
-*     bodies are never edited.
-*   • product_enablement:write — the "Enable products" step turns on
-*     Session Replay / Error Tracking / Support so their sources have
-*     data to read (`products-enable`). A purpose-built scope: the
-*     server owns each enable recipe, so this can flip the product
-*     toggles without the far broader `project:write`.
-*   • replay_scanner:read / replay_scanner:write — the Replay Vision
-*     scanners step (skill step 6c) lists the team's existing scanners
-*     and creates the `emits_signals` ones whose findings land in the
-*     inbox (`vision-scanners-list` / `-create` / `-update`, and the
-*     advisory `vision-scanners-estimate-create` / `vision-quota-retrieve`).
-*     The scope OBJECT is `replay_scanner` — the `vision-scanners-*`
-*     names are MCP tool names, not scopes. Configuring a scanner also
-*     requires `session_recording:read` (the API pairs the two, since a
-*     scanner's config indirectly exposes recording contents); that one
-*     is already in this list for the step-2 usage probes.
-*
-* No OAuth-ceiling edit is needed for any scope here: they are all normal
-* public (unprivileged, non-internal, non-hidden) scope objects, and the
-* live wizard apps' ceiling is the `@default` sentinel, which resolves to
-* every such scope (`UNPRIVILEGED_SCOPES`) and auto-tracks new ones. Only a
-* privileged/internal/hidden object (e.g. `llm_gateway:*`) would need a
-* manual per-app edit. See README → "OAuth app scope ceiling".
+* Build an `OAuthError` from an authorize-callback's query params.
+* Sanitizes every field — the callback URL is attacker-reachable input.
 */
-const SELF_DRIVING_SCOPE_ADDITIONS = [
-	"task:read",
-	"task:write",
-	"integration:read",
-	"signal_scout:read",
-	"signal_scout:write",
-	"session_recording:read",
-	"survey:read",
-	"error_tracking:read",
-	"external_data_source:read",
-	"external_data_source:write",
-	"llm_skill:read",
-	"llm_skill:write",
-	"product_enablement:write",
-	"replay_scanner:read",
-	"replay_scanner:write"
-];
+function oauthErrorFromCallbackParams(params) {
+	return new OAuthError(sanitizeOAuthParam(params.get("error")) ?? "unknown", sanitizeOAuthParam(params.get("error_description"), MAX_DESCRIPTION_LENGTH), sanitizeOAuthParam(params.get("error_uri")));
+}
 /**
-* Extra scopes the warehouse-source program needs on top of
-* `WIZARD_OAUTH_SCOPES`. The agent creates data warehouse sources directly
-* (`external-data-sources-create`) and lists what's connected
-* (`external-data-sources-list`) to verify the result. Both are already within
-* the wizard OAuth app's scope ceiling — the self-driving program requests the
-* same pair.
+* Build an `OAuthError` from a token-endpoint JSON error body (RFC 6749
+* §5.2). Returns null when the body isn't an OAuth error shape (HTML error
+* pages, proxy bodies, network failures) — the caller rethrows the raw
+* error in that case.
 */
-const WAREHOUSE_SOURCE_SCOPE_ADDITIONS = ["external_data_source:read", "external_data_source:write"];
+function oauthErrorFromTokenBody(data) {
+	const parsed = OAuthErrorBodySchema.safeParse(data);
+	if (!parsed.success) return null;
+	return new OAuthError(sanitizeOAuthParam(parsed.data.error) ?? "unknown", sanitizeOAuthParam(parsed.data.error_description, MAX_DESCRIPTION_LENGTH), sanitizeOAuthParam(parsed.data.error_uri));
+}
 /**
-* Extra scope the Connect-Slack step needs on top of `WIZARD_OAUTH_SCOPES`.
-*
-* The step polls `/api/projects/:id/integrations/` (`fetchSlackConnected`)
-* to render the already-connected variant and to flip live once the user
-* completes the Slack OAuth step in the browser. Without `integration:read`
-* the first poll 403s, the screen stops polling, and an already-connected
-* project is nagged with the connect nudge. Used by the default integration
-* run (the step ends the run) and by the standalone `wizard slack` flow
-* (the step is the whole program).
+* The error paragraphs for the browser callback page. The constant framing
+* (title, styles, "return to your terminal") stays in `oauth.ts`; this owns
+* the part that varies by error, with everything HTML-escaped since the
+* values come straight off the callback query string.
 */
-const CONNECT_SLACK_SCOPE_ADDITIONS = ["integration:read"];
-/**
-* Extra scopes the replay-vision program needs on top of `WIZARD_OAUTH_SCOPES`.
-* The same set self-driving's step 6c uses, narrowed to just this flow:
-*   • replay_scanner:read / replay_scanner:write — the scanner tasks list the
-*     team's existing scanners and create the ones scoped to the product's key
-*     flows (`vision-scanners-list` / `-create`, plus the advisory
-*     `vision-scanners-estimate-create` / `vision-quota-retrieve`). The scope
-*     OBJECT is `replay_scanner`; `vision-scanners-*` are MCP tool names.
-*   • session_recording:read — the scanner API pairs it with
-*     `replay_scanner:*`, since a scanner's config indirectly exposes
-*     recording contents. Configuring a scanner fails without it.
-*   • product_enablement:write — the enable-replay task's server half turns on
-*     Session Replay (`products-enable`) so there are recordings to scan.
-*
-* Without these the PostHog MCP omits the tools from the catalog it serves
-* this token, every scanner task takes its "tool unknown" skip path, and the
-* run reports success having created nothing (run 69afc6f8).
-*
-* No OAuth-ceiling edit needed — all are unprivileged public scope objects
-* covered by the apps' `@default` sentinel, and self-driving already requests
-* every one of them.
-*/
-const REPLAY_VISION_SCOPE_ADDITIONS = [
-	"session_recording:read",
-	"product_enablement:write",
-	"replay_scanner:read",
-	"replay_scanner:write"
-];
-/**
-* Per-program scope additions, layered on top of `WIZARD_OAUTH_SCOPES`.
-*
-* Programs not listed here request the unchanged base set. Use this
-* map only for programs that need *more* than the base — never for
-* narrowing, since narrowing risks breaking shared infrastructure
-* (e.g. dropping `llm_gateway:read` would 401 every agent call).
-*
-* Keyed by `ProgramId` so TypeScript catches stale entries when a
-* program is renamed or removed.
-*/
-const PROGRAM_SCOPE_ADDITIONS = {
-	"mcp-tutorial": MCP_TUTORIAL_SCOPE_ADDITIONS,
-	"agent-skill": AGENT_SKILL_SCOPE_ADDITIONS,
-	"self-driving": SELF_DRIVING_SCOPE_ADDITIONS,
-	"warehouse-source": WAREHOUSE_SOURCE_SCOPE_ADDITIONS,
-	"posthog-integration": [...CONNECT_SLACK_SCOPE_ADDITIONS, ...WAREHOUSE_SOURCE_SCOPE_ADDITIONS],
-	slack: CONNECT_SLACK_SCOPE_ADDITIONS,
-	"replay-vision": REPLAY_VISION_SCOPE_ADDITIONS
-};
-/**
-* Resolve the OAuth scope list to request for a given program. Returns
-* `WIZARD_OAUTH_SCOPES` for programs without an addition entry; for
-* programs that do have one, returns the union of base + additions
-* with duplicates dropped (declaration order preserved, base first).
-*
-* `null` / `undefined` programId falls through to the default — same
-* behavior as the historical hardcoded `WIZARD_OAUTH_SCOPES` reference
-* in `askForWizardLogin`, so call sites that haven't been updated to
-* pass a programId continue to work unchanged.
-*/
-function getOAuthScopesForProgram(programId) {
-	const additions = programId && PROGRAM_SCOPE_ADDITIONS[programId] || [];
-	if (additions.length === 0) return WIZARD_OAUTH_SCOPES;
-	const seen = /* @__PURE__ */ new Set();
-	const merged = [];
-	for (const s of [...WIZARD_OAUTH_SCOPES, ...additions]) {
-		if (seen.has(s)) continue;
-		seen.add(s);
-		merged.push(s);
-	}
-	return merged;
-}
-/**
-* Resolve the scope list for the signup provisioning path. Same
-* base-plus-additions shape as `getOAuthScopesForProgram`, but layered on
-* `WIZARD_PROVISIONING_SCOPES` so a program's extra scopes only reach
-* tokens provisioned for that program.
-*/
-function getProvisioningScopesForProgram(programId) {
-	const additions = programId && PROGRAM_SCOPE_ADDITIONS[programId] || [];
-	if (additions.length === 0) return WIZARD_PROVISIONING_SCOPES;
-	const seen = /* @__PURE__ */ new Set();
-	const merged = [];
-	for (const s of [...WIZARD_PROVISIONING_SCOPES, ...additions]) {
-		if (seen.has(s)) continue;
-		seen.add(s);
-		merged.push(s);
-	}
-	return merged;
-}
-//#endregion
-//#region src/shared/host-resolution.ts
-/**
-* HostResolution — the single, immutable snapshot of where the wizard talks to
-* PostHog for one run.
-*
-* One cloud region (or a pinned `--base-url`) implies a whole family of hosts:
-* the event-ingestion/API host, the user-facing web app host, the CDN asset
-* host, the LLM gateway, and the MCP server. Rather than re-deriving each of
-* these at every call site and threading `region` + `baseUrl` around as loose
-* params, resolve once at auth time and pass this frozen object around — read
-* the property you need.
-*
-* The actual region→URL math (and the `--base-url` override) lives in
-* `@utils/urls`; this class is a thin, immutable façade over those resolvers so
-* the override flows through every field without callers having to know about
-* it. The OAuth-server URL stays in `@utils/urls` (`getOAuthUrl`) because it is
-* needed *before* a region is known, so it can't come from this post-auth object.
-*/
-const MCP_PROD_URL = "https://mcp.posthog.com/mcp";
-function assetHostFor(region, baseUrl) {
-	const override = resolveBaseUrl(baseUrl);
-	if (override) return override;
-	return region === "eu" ? "https://eu-assets.i.posthog.com" : "https://us-assets.i.posthog.com";
-}
-function assetHostFromApiHost(apiHost) {
-	if (apiHost.includes("us.i.posthog.com")) return "https://us-assets.i.posthog.com";
-	if (apiHost.includes("eu.i.posthog.com")) return "https://eu-assets.i.posthog.com";
-	return apiHost;
-}
-/**
-* Dev/CI only: the env override (see env.ts) wins even under --local-mcp;
-* published builds strip the read. Don't name that env var in comments here —
-* smoke-test.sh greps dist/*.js for it, and JSDoc survives bundling.
-*/
-function mcpUrlFor(localMcp) {
-	return localMcp ? MCP_LOCAL_URL : MCP_PROD_URL;
-}
-var HostResolution = class HostResolution {
-	/** The resolved cloud region. `'us'` when a base URL is pinned. */
-	region;
-	/**
-	* Event-ingestion / REST API host (e.g. `https://us.i.posthog.com`, or the
-	* pinned `--base-url`). The SDK `host` written into the user's `.env`, the
-	* base for the wizard-session REST calls, and the host shown to the agent.
-	*/
-	apiHost;
-	/**
-	* User-facing web app host (e.g. `https://us.posthog.com`). Use for any link
-	* we hand to the user or open in their browser (dashboards, settings, inbox,
-	* deep-link base).
-	*/
-	appHost;
-	/** CDN asset host (e.g. `https://us-assets.i.posthog.com`). */
-	assetHost;
-	/**
-	* PostHog MCP server URL the agent connects to. Region-independent — the
-	* server resolves the user's region from the bearer token — so this is driven
-	* only by `--local-mcp` / `--local-dev` and the dev env override, not by
-	* region/base-url.
-	*/
-	mcpUrl;
-	constructor(fields) {
-		this.region = fields.region;
-		this.apiHost = fields.apiHost;
-		this.appHost = fields.appHost;
-		this.assetHost = fields.assetHost;
-		this.mcpUrl = fields.mcpUrl;
-		Object.freeze(this);
-	}
-	/**
-	* Canonical path: build the host family from a resolved region. A pinned
-	* `--base-url` (via `opts.baseUrl`) wins for every origin; otherwise the
-	* region's standard hosts are used. Honors IS_DEV through `resolveBaseUrl`.
-	*/
-	static fromRegion(region, opts = {}) {
-		return new HostResolution({
-			region,
-			apiHost: getHost(region, opts.baseUrl),
-			appHost: getCloudUrl(region, opts.baseUrl),
-			assetHost: assetHostFor(region, opts.baseUrl),
-			mcpUrl: mcpUrlFor(opts.localMcp ?? false)
-		});
-	}
-	/**
-	* Build from an ingestion host string (the provisioning API returns one). The
-	* given host is preserved verbatim as `apiHost`; the region and the derived
-	* app/asset/gateway hosts are inferred from it.
-	*/
-	static fromApiHost(apiHost, opts = {}) {
-		return new HostResolution({
-			region: apiHost.includes("eu.") ? "eu" : "us",
-			apiHost,
-			appHost: getUiHostFromHost(apiHost),
-			assetHost: assetHostFromApiHost(apiHost),
-			mcpUrl: mcpUrlFor(opts.localMcp ?? false)
-		});
-	}
-	/**
-	* Resolve the region from an access token (the us/eu probe, skipped when a
-	* base URL is pinned), then build the host family. Used after OAuth and after
-	* CI-mode API-key auth.
-	*/
-	static async fromAccessToken(accessToken, opts = {}) {
-		const region = opts.region ?? await detectRegion(accessToken, opts.baseUrl);
-		return HostResolution.fromRegion(region, opts);
-	}
-};
-//#endregion
-//#region src/shared/utils/oauth-errors.ts
-/**
-* OAuth failure presentation — the structured error the flow throws and the
-* user-facing messaging built from it.
-*
-* `oauth.ts` owns the flow machinery (callback server, token exchange, port
-* retries); this module owns what a failure *means*: the RFC 6749 error
-* fields (`error`, `error_description`, `error_uri`), per-code remediation
-* copy, and safe rendering for the browser callback page. Everything here is
-* pure so the copy can be unit-tested without the HTTP machinery.
-*/
-/**
-* A structured OAuth failure (RFC 6749 §4.1.2.1 authorize errors, §5.2 token
-* errors). Thrown by both the authorize callback and the token exchange so
-* the flow's error handler keys remediation copy and analytics fingerprints
-* off `code` instead of re-parsing `message`.
-*
-* The message stays exactly `OAuth error: <code>` — the analytics fingerprint
-* scheme (`wizard_oauth_<code>`) and the legacy message-prefix parsing both
-* depend on that shape. The description/uri ride along as properties.
-*
-* NAMING: never bind an instance to a variable or property whose name
-* contains "oauth" (use `flowError`, `callbackError`, ...). CodeQL's
-* clear-text-logging heuristic classifies any `*oauth*`-named variable read
-* as password data, and these errors are deliberately shown to the user, so
-* such a binding flags every log statement downstream of it (CWE-312).
-*/
-var OAuthError = class extends Error {
-	code;
-	/** The server's human-readable explanation (`error_description`), if sent. */
-	description;
-	/** The server's "more info" link (`error_uri`), if sent. */
-	uri;
-	constructor(code, description, uri) {
-		super(`OAuth error: ${code}`);
-		this.name = "OAuthError";
-		this.code = code;
-		this.description = description;
-		this.uri = uri;
-	}
-};
-/**
-* Sanitize an OAuth error param before logging or rendering it: these arrive
-* on a query string (or a token-endpoint body) that anything able to hit the
-* local callback port can populate. Strips non-printable/non-ASCII characters
-* and caps the length. Returns undefined when nothing printable remains.
-*/
-function sanitizeOAuthParam(value, maxLength = 200) {
-	if (!value) return void 0;
-	return value.replace(/[^\x20-\x7e]/g, "").slice(0, maxLength).trim() || void 0;
-}
-/** Description sentences get more room than bare codes/URIs. */
-const MAX_DESCRIPTION_LENGTH = 500;
-function escapeHtml(value) {
-	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-const OAuthErrorBodySchema = z.object({
-	error: z.string().min(1),
-	error_description: z.string().optional(),
-	error_uri: z.string().optional()
-});
-/**
-* Build an `OAuthError` from an authorize-callback's query params.
-* Sanitizes every field — the callback URL is attacker-reachable input.
-*/
-function oauthErrorFromCallbackParams(params) {
-	return new OAuthError(sanitizeOAuthParam(params.get("error")) ?? "unknown", sanitizeOAuthParam(params.get("error_description"), MAX_DESCRIPTION_LENGTH), sanitizeOAuthParam(params.get("error_uri")));
-}
-/**
-* Build an `OAuthError` from a token-endpoint JSON error body (RFC 6749
-* §5.2). Returns null when the body isn't an OAuth error shape (HTML error
-* pages, proxy bodies, network failures) — the caller rethrows the raw
-* error in that case.
-*/
-function oauthErrorFromTokenBody(data) {
-	const parsed = OAuthErrorBodySchema.safeParse(data);
-	if (!parsed.success) return null;
-	return new OAuthError(sanitizeOAuthParam(parsed.data.error) ?? "unknown", sanitizeOAuthParam(parsed.data.error_description, MAX_DESCRIPTION_LENGTH), sanitizeOAuthParam(parsed.data.error_uri));
-}
-/**
-* The error paragraphs for the browser callback page. The constant framing
-* (title, styles, "return to your terminal") stays in `oauth.ts`; this owns
-* the part that varies by error, with everything HTML-escaped since the
-* values come straight off the callback query string.
-*/
-function buildCallbackErrorHtml(error) {
-	if (error.code === "access_denied") return "<p>Authorization cancelled.</p>";
-	const paragraphs = [`<p>Authorization failed (${escapeHtml(error.code)}).</p>`];
-	if (error.description) paragraphs.push(`<p>${escapeHtml(error.description)}</p>`);
-	if (error.uri) paragraphs.push(`<p>More info: ${escapeHtml(error.uri)}</p>`);
-	return paragraphs.join("\n");
-}
+function buildCallbackErrorHtml(error) {
+	if (error.code === "access_denied") return "<p>Authorization cancelled.</p>";
+	const paragraphs = [`<p>Authorization failed (${escapeHtml(error.code)}).</p>`];
+	if (error.description) paragraphs.push(`<p>${escapeHtml(error.description)}</p>`);
+	if (error.uri) paragraphs.push(`<p>More info: ${escapeHtml(error.uri)}</p>`);
+	return paragraphs.join("\n");
+}
 /**
 * Per-code headline + "what to do" remediation for the terminal failure
 * message. Codes not listed fall through to a generic rendering of the
@@ -658,29 +168,7 @@ function buildOAuthFailureMessage(params) {
 	return sections.join("\n\n");
 }
 //#endregion
-//#region src/shared/utils/oauth.ts
-const OAUTH_CALLBACK_STYLES = `
-  <style>
-    * {
-      font-family: monospace;
-      background-color: #1b0a00;
-      color: #F7A502;
-      font-weight: medium;
-      font-size: 24px;
-      margin: .25rem;
-    }
-
-    .blink {
-      animation: blink-animation 1s steps(2, start) infinite;
-    }
-
-    @keyframes blink-animation {
-      to {
-        opacity: 0;
-      }
-    }
-  </style>
-`;
+//#region src/programs/oauth/tokens.ts
 const OAuthTokenResponseSchema = z.object({
 	access_token: z.string(),
 	expires_in: z.number(),
@@ -692,7 +180,6 @@ const OAuthTokenResponseSchema = z.object({
 	posthog_region: z.enum(["us", "eu"]).optional().catch(void 0),
 	posthog_base_url: z.string().optional().catch(void 0)
 });
-const WIZARD_COMPLETION_SCOPE = "event_definition:write";
 function parseOAuthScopes(scope) {
 	return scope.split(/\s+/).filter(Boolean);
 }
@@ -710,14 +197,6 @@ function missingOAuthScopes(requested, grantedScope) {
 	const granted = new Set(parseOAuthScopes(grantedScope));
 	return requested.filter((scope) => !granted.has(scope));
 }
-function assertWizardCompletionScope(scope) {
-	if (parseOAuthScopes(scope).includes("event_definition:write")) return;
-	throw new Error(`This run was authorized without the ${WIZARD_COMPLETION_SCOPE} permission, which the wizard needs to finish setup. Please try again, approving all permissions on the PostHog authorization screen. If that screen does not reappear, revoke the existing PostHog Wizard authorization in your PostHog settings first.`);
-}
-const AUTHORIZATION_TIMEOUT_MESSAGE = "Authorization timed out";
-function isAuthorizationTimeout(error) {
-	return error.message === AUTHORIZATION_TIMEOUT_MESSAGE;
-}
 /**
 * OAuth client ID for the current target. A pinned base URL (`--base-url`, or
 * IS_DEV's implicit localhost) means we're talking to a dev-seeded stack, which
@@ -731,42 +210,98 @@ function isAuthorizationTimeout(error) {
 function getOAuthClientId(baseUrl) {
 	return resolveBaseUrl(baseUrl) ? POSTHOG_DEV_CLIENT_ID : POSTHOG_PROXY_CLIENT_ID;
 }
-function getLocalOAuthOrigin(port) {
-	return `http://localhost:${port}`;
-}
-function getCallbackUrl(port) {
-	return `${getLocalOAuthOrigin(port)}/callback`;
-}
-function getLocalLoginUrl(port) {
-	return `${getLocalOAuthOrigin(port)}/authorize`;
-}
-function getLocalSignupUrl(port) {
-	return `${getLocalLoginUrl(port)}?signup=true`;
-}
-/**
-* Extract an OAuth authorization code from raw user input. Accepts either the
-* bare code, the full callback URL the browser was redirected to
-* (`http://localhost:8239/callback?code=abc123&...`), or just the query
-* string. Returns null when no code can be found.
-*
-* This backs the manual-entry fallback: in headless/remote environments the
-* browser can't reach the wizard's local callback server, so the user copies
-* the failed callback URL (or the code from it) back into the terminal.
-*/
-function extractOAuthCode(input) {
-	const trimmed = input.trim();
-	if (!trimmed) return null;
-	let looksLikeUrl = false;
+async function refreshAccessToken(refreshToken, baseUrl, clientId) {
+	const oauthUrl = getOAuthUrl(baseUrl);
+	logToFile(`[oauth] refreshing access token at ${oauthUrl}/oauth/token`);
 	try {
-		const url = new URL(trimmed);
-		looksLikeUrl = true;
-		const code = url.searchParams.get("code");
-		if (code) return code;
-	} catch {}
-	const match = trimmed.match(/[?&]?code=([^&\s]+)/);
-	if (match) return decodeURIComponent(match[1]);
-	if (looksLikeUrl) return null;
-	if (!/\s/.test(trimmed)) return trimmed;
+		const response = await axios.post(`${oauthUrl}/oauth/token`, {
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: clientId ?? getOAuthClientId(baseUrl)
+		}, {
+			headers: {
+				"Content-Type": "application/json",
+				"User-Agent": WIZARD_USER_AGENT
+			},
+			timeout: 3e4
+		});
+		const token = OAuthTokenResponseSchema.parse(response.data);
+		logToFile("[oauth] access token refreshed");
+		return token;
+	} catch (e) {
+		logToFile("[oauth] token refresh failed:", e instanceof Error ? e.message : e);
+		throw (axios.isAxiosError(e) ? oauthErrorFromTokenBody(e.response?.data) : null) ?? e;
+	}
+}
+//#endregion
+//#region src/tui/auth/oauth.ts
+const OAUTH_CALLBACK_STYLES = `
+  <style>
+    * {
+      font-family: monospace;
+      background-color: #1b0a00;
+      color: #F7A502;
+      font-weight: medium;
+      font-size: 24px;
+      margin: .25rem;
+    }
+
+    .blink {
+      animation: blink-animation 1s steps(2, start) infinite;
+    }
+
+    @keyframes blink-animation {
+      to {
+        opacity: 0;
+      }
+    }
+  </style>
+`;
+const WIZARD_COMPLETION_SCOPE = "event_definition:write";
+function assertWizardCompletionScope(scope) {
+	if (parseOAuthScopes(scope).includes("event_definition:write")) return;
+	throw new Error(`This run was authorized without the ${WIZARD_COMPLETION_SCOPE} permission, which the wizard needs to finish setup. Please try again, approving all permissions on the PostHog authorization screen. If that screen does not reappear, revoke the existing PostHog Wizard authorization in your PostHog settings first.`);
+}
+const AUTHORIZATION_TIMEOUT_MESSAGE = "Authorization timed out";
+function isAuthorizationTimeout(error) {
+	return error.message === AUTHORIZATION_TIMEOUT_MESSAGE;
+}
+function getLocalOAuthOrigin(port) {
+	return `http://localhost:${port}`;
+}
+function getCallbackUrl(port) {
+	return `${getLocalOAuthOrigin(port)}/callback`;
+}
+function getLocalLoginUrl(port) {
+	return `${getLocalOAuthOrigin(port)}/authorize`;
+}
+function getLocalSignupUrl(port) {
+	return `${getLocalLoginUrl(port)}?signup=true`;
+}
+/**
+* Extract an OAuth authorization code from raw user input. Accepts either the
+* bare code, the full callback URL the browser was redirected to
+* (`http://localhost:8239/callback?code=abc123&...`), or just the query
+* string. Returns null when no code can be found.
+*
+* This backs the manual-entry fallback: in headless/remote environments the
+* browser can't reach the wizard's local callback server, so the user copies
+* the failed callback URL (or the code from it) back into the terminal.
+*/
+function extractOAuthCode(input) {
+	const trimmed = input.trim();
+	if (!trimmed) return null;
+	let looksLikeUrl = false;
+	try {
+		const url = new URL(trimmed);
+		looksLikeUrl = true;
+		const code = url.searchParams.get("code");
+		if (code) return code;
+	} catch {}
+	const match = trimmed.match(/[?&]?code=([^&\s]+)/);
+	if (match) return decodeURIComponent(match[1]);
+	if (looksLikeUrl) return null;
+	if (!/\s/.test(trimmed)) return trimmed;
 	return null;
 }
 function generateCodeVerifier() {
@@ -964,142 +499,374 @@ async function exchangeCodeForToken(code, codeVerifier, callbackUrl, baseUrl) {
 	logToFile(`[oauth] token exchange succeeded, granted scopes: ${token.scope}${token.posthog_region ? `, region: ${token.posthog_region}` : ""}${token.scoped_teams ? `, scoped_teams: [${token.scoped_teams.join(", ")}]` : ""}${token.scoped_organizations ? `, scoped_organizations: ${token.scoped_organizations.length}` : ""}`);
 	return token;
 }
-async function refreshAccessToken(refreshToken, baseUrl, clientId) {
-	const oauthUrl = getOAuthUrl(baseUrl);
-	logToFile(`[oauth] refreshing access token at ${oauthUrl}/oauth/token`);
-	try {
-		const response = await axios.post(`${oauthUrl}/oauth/token`, {
-			grant_type: "refresh_token",
-			refresh_token: refreshToken,
-			client_id: clientId ?? getOAuthClientId(baseUrl)
-		}, {
-			headers: {
-				"Content-Type": "application/json",
-				"User-Agent": WIZARD_USER_AGENT
-			},
-			timeout: 3e4
-		});
-		const token = OAuthTokenResponseSchema.parse(response.data);
-		logToFile("[oauth] access token refreshed");
-		return token;
-	} catch (e) {
-		logToFile("[oauth] token refresh failed:", e instanceof Error ? e.message : e);
-		throw (axios.isAxiosError(e) ? oauthErrorFromTokenBody(e.response?.data) : null) ?? e;
+/**
+* Warn — at login, while the user is still watching — when the grant came back
+* narrower than the request, and record the gap so narrowed runs are countable.
+* Non-fatal by design: deselecting an optional scope is the user's call, and
+* most flows survive it. The one scope the wizard cannot run without has its
+* own hard check (`assertWizardCompletionScope`).
+*/
+function reportNarrowedGrant(requestedScopes, grantedScope) {
+	const missing = missingOAuthScopes(requestedScopes, grantedScope);
+	if (missing.length === 0) return;
+	logToFile(`[oauth] grant narrower than request, missing: ${missing.join(" ")}`);
+	analytics.wizardCapture("oauth grant narrowed", {
+		requested_scopes: [...requestedScopes].sort().join(" "),
+		granted_scopes: parseOAuthScopes(grantedScope).sort().join(" "),
+		missing_scopes: missing.join(" "),
+		missing_scope_count: missing.length
+	});
+	const plural = missing.length > 1;
+	getUI().log.warn(`Your PostHog authorization is missing ${plural ? `${missing.length} permissions` : "a permission"} the wizard asked for: ${missing.join(", ")}. Setup will continue, but steps that need ${plural ? "them" : "it"} may fail. To grant ${plural ? "them" : "it"}, re-run the wizard and approve all permissions on the authorization screen. If that screen does not reappear, revoke the existing PostHog Wizard authorization in your PostHog settings first.`);
+}
+async function performOAuthFlow(config) {
+	const clientId = getOAuthClientId(config.baseUrl);
+	const oauthUrl = getOAuthUrl(config.baseUrl);
+	const codeVerifier = generateCodeVerifier();
+	const codeChallenge = generateCodeChallenge(codeVerifier);
+	let shouldRetry = false;
+	logToFile(`[oauth] starting flow against ${oauthUrl}, requested scopes: ${config.scopes.join(" ")}`);
+	do {
+		shouldRetry = false;
+		let lastProcessInfo = null;
+		for (const port of OAUTH_PORTS) {
+			const callbackUrl = getCallbackUrl(port);
+			const authUrl = new URL(`${oauthUrl}/oauth/authorize`);
+			authUrl.searchParams.set("client_id", clientId);
+			authUrl.searchParams.set("redirect_uri", callbackUrl);
+			authUrl.searchParams.set("response_type", "code");
+			authUrl.searchParams.set("code_challenge", codeChallenge);
+			authUrl.searchParams.set("code_challenge_method", "S256");
+			authUrl.searchParams.set("scope", config.scopes.join(" "));
+			authUrl.searchParams.set("required_access_level", "project");
+			if (config.projectId !== void 0) authUrl.searchParams.set("team_id", String(config.projectId));
+			const taggedAuthUrl = withUtm(authUrl.toString(), "oauth-authorize");
+			const signupUrl = new URL(withUtm(`${oauthUrl}/signup?next=${encodeURIComponent(taggedAuthUrl)}`, "oauth-signup"));
+			const localSignupUrl = getLocalSignupUrl(port);
+			const localLoginUrl = getLocalLoginUrl(port);
+			const urlToOpen = config.signup ? localSignupUrl : localLoginUrl;
+			logToFile(`[oauth] attempting callback server on port ${port}`);
+			let server;
+			let waitForCallback;
+			try {
+				({server, waitForCallback} = await startCallbackServer(taggedAuthUrl, signupUrl.toString(), port));
+			} catch (e) {
+				if (!isPortInUseError(e)) throw e;
+				lastProcessInfo = getPortProcessInfo(port);
+				continue;
+			}
+			logToFile("[oauth] callback server ready, showing login URL");
+			getUI().setLoginUrl(urlToOpen);
+			getUI().setAuthorizeUrl(config.signup ? signupUrl.toString() : taggedAuthUrl);
+			openTrackedLink(urlToOpen, "oauth", {
+				auto: true,
+				skipUtm: true
+			});
+			const loginSpinner = getUI().spinner();
+			loginSpinner.start("Waiting for authorization...");
+			try {
+				const token = await exchangeCodeForToken(await Promise.race([
+					waitForCallback(),
+					getUI().waitForManualAuthCode(),
+					new Promise((_, reject) => setTimeout(() => reject(new Error(AUTHORIZATION_TIMEOUT_MESSAGE)), OAUTH_TIMEOUT_MS))
+				]), codeVerifier, callbackUrl, config.baseUrl);
+				server.close();
+				getUI().setLoginUrl(null);
+				getUI().setAuthorizeUrl(null);
+				loginSpinner.stop("Authorization complete!");
+				reportNarrowedGrant(config.scopes, token.scope);
+				return token;
+			} catch (e) {
+				const error = e instanceof Error ? e : /* @__PURE__ */ new Error("Unknown error");
+				const timedOut = isAuthorizationTimeout(error);
+				const flowError = error instanceof OAuthError ? error : null;
+				loginSpinner.stop(timedOut ? "Session timed out." : "Authorization failed.");
+				server.close();
+				logToFile("[oauth] flow failed:", error);
+				if (flowError?.description) logToFile(`[oauth] server error_description: ${flowError.description}`);
+				const accessDenied = flowError ? flowError.code === "access_denied" : error.message.includes("access_denied");
+				if (timedOut) getUI().showSessionTimeout();
+				else if (accessDenied) getUI().log.info(`Authorization was cancelled.\n\nYou denied access to PostHog. To use the wizard, you need to authorize access to your PostHog account.\n\nYou can try again by re-running the wizard.`);
+				else getUI().log.error(buildOAuthFailureMessage({
+					error,
+					requestedScopes: config.scopes,
+					clientId,
+					oauthUrl,
+					isDevStack: resolveBaseUrl(config.baseUrl) !== void 0
+				}));
+				const oauthErrorCode = flowError ? flowError.code : error.message.startsWith("OAuth error: ") ? error.message.slice(13) : timedOut ? "timeout" : "unknown";
+				analytics.captureException(error, {
+					step: "oauth_flow",
+					oauth_error_code: oauthErrorCode,
+					oauth_error_description: flowError?.description,
+					client_id: clientId,
+					requested_scopes: config.scopes.join(" "),
+					$exception_fingerprint: `wizard_oauth_${oauthErrorCode}`
+				});
+				await abort();
+				throw error;
+			}
+		}
+		if (!lastProcessInfo) throw new Error("No OAuth callback ports configured");
+		await getUI().showPortConflict(lastProcessInfo);
+		shouldRetry = true;
+	} while (shouldRetry);
+	throw new Error("OAuth port retry loop exited unexpectedly");
+}
+//#endregion
+//#region src/programs/agent-skill/scopes.ts
+/**
+* Extra scopes the agent-skill program needs on top of `WIZARD_OAUTH_SCOPES`.
+*
+* Skills under this program (e.g. `creating-product-tours`) create feature
+* flags during the install flow. PostHog's consent grants exactly the scope
+* strings requested — `:write` does not imply `:read` — so listing existing
+* flags to avoid key collisions needs `feature_flag:read` explicitly.
+* `property_definition:read` lets the agent discover person properties when
+* building flag rollout filters instead of having to ask the user verbatim.
+*/
+const AGENT_SKILL_SCOPE_ADDITIONS = [
+	"feature_flag:read",
+	"feature_flag:write",
+	"property_definition:read"
+];
+//#endregion
+//#region src/programs/replay-vision/scopes.ts
+/**
+* Extra scopes the replay-vision program needs on top of `WIZARD_OAUTH_SCOPES`.
+* The same set self-driving's step 6c uses, narrowed to just this flow:
+*   • replay_scanner:read / replay_scanner:write — the scanner tasks list the
+*     team's existing scanners and create the ones scoped to the product's key
+*     flows (`vision-scanners-list` / `-create`, plus the advisory
+*     `vision-scanners-estimate-create` / `vision-quota-retrieve`). The scope
+*     OBJECT is `replay_scanner`; `vision-scanners-*` are MCP tool names.
+*   • session_recording:read — the scanner API pairs it with
+*     `replay_scanner:*`, since a scanner's config indirectly exposes
+*     recording contents. Configuring a scanner fails without it.
+*   • product_enablement:write — the enable-replay task's server half turns on
+*     Session Replay (`products-enable`) so there are recordings to scan.
+*
+* Without these the PostHog MCP omits the tools from the catalog it serves
+* this token, every scanner task takes its "tool unknown" skip path, and the
+* run reports success having created nothing (run 69afc6f8).
+*
+* No OAuth-ceiling edit needed — all are unprivileged public scope objects
+* covered by the apps' `@default` sentinel, and self-driving already requests
+* every one of them.
+*/
+const REPLAY_VISION_SCOPE_ADDITIONS = [
+	"session_recording:read",
+	"product_enablement:write",
+	"replay_scanner:read",
+	"replay_scanner:write"
+];
+//#endregion
+//#region src/programs/self-driving/scopes.ts
+/**
+* Extra scopes the self-driving program needs on top of
+* `WIZARD_OAUTH_SCOPES`. All consumed by the PostHog MCP tools the
+* agent drives during the run:
+*   • task:read / task:write — the signal source config API
+*     (`inbox-source-configs-*`) is permissioned under the generic
+*     `task` scope object, NOT a signals-specific one. Unrelated to
+*     the Tasks product.
+*   • integration:read — `integrations-list`, to check whether the
+*     team already has a GitHub integration and to verify the connect
+*     flow completed.
+*   • signal_scout:read / signal_scout:write — list, sync, and tune
+*     the Signals scout troop (`signals-scout-config-*`).
+*   • session_recording:read / survey:read / error_tracking:read —
+*     server-side product-usage probes (`query-session-recordings-list`,
+*     `survey-list`, `error-issue-list`). Product usage is a
+*     project-level fact (often instrumented in another repo or via
+*     the snippet), so the agent asks the server instead of inferring
+*     only from the local setup report. All three are read-only and
+*     already in the wizard OAuth app's production scope ceiling (the
+*     mcp-tutorial program requests them).
+*   • external_data_source:read / external_data_source:write — the
+*     connected-tools step creates the GitHub Issues / Linear warehouse
+*     sources directly (`external-data-sources-create`) and verifies
+*     what's actually connected (`external-data-sources-list`) instead
+*     of taking the user's word for it.
+*   • llm_skill:read / llm_skill:write — the custom-scouts step
+*     (skill step 6b): read the seeded `authoring-signals-scouts`
+*     guide and canonical scout bodies (`llma-skill-get` /
+*     `llma-skill-file-get`) and author the user-approved custom
+*     `signals-scout-*` skills (`llma-skill-create`). Canonical scout
+*     bodies are never edited.
+*   • product_enablement:write — the "Enable products" step turns on
+*     Session Replay / Error Tracking / Support so their sources have
+*     data to read (`products-enable`). A purpose-built scope: the
+*     server owns each enable recipe, so this can flip the product
+*     toggles without the far broader `project:write`.
+*   • replay_scanner:read / replay_scanner:write — the Replay Vision
+*     scanners step (skill step 6c) lists the team's existing scanners
+*     and creates the `emits_signals` ones whose findings land in the
+*     inbox (`vision-scanners-list` / `-create` / `-update`, and the
+*     advisory `vision-scanners-estimate-create` / `vision-quota-retrieve`).
+*     The scope OBJECT is `replay_scanner` — the `vision-scanners-*`
+*     names are MCP tool names, not scopes. Configuring a scanner also
+*     requires `session_recording:read` (the API pairs the two, since a
+*     scanner's config indirectly exposes recording contents); that one
+*     is already in this list for the step-2 usage probes.
+*
+* No OAuth-ceiling edit is needed for any scope here: they are all normal
+* public (unprivileged, non-internal, non-hidden) scope objects, and the
+* live wizard apps' ceiling is the `@default` sentinel, which resolves to
+* every such scope (`UNPRIVILEGED_SCOPES`) and auto-tracks new ones. Only a
+* privileged/internal/hidden object (e.g. `llm_gateway:*`) would need a
+* manual per-app edit. See README → "OAuth app scope ceiling".
+*/
+const SELF_DRIVING_SCOPE_ADDITIONS = [
+	"task:read",
+	"task:write",
+	"integration:read",
+	"signal_scout:read",
+	"signal_scout:write",
+	"session_recording:read",
+	"survey:read",
+	"error_tracking:read",
+	"external_data_source:read",
+	"external_data_source:write",
+	"llm_skill:read",
+	"llm_skill:write",
+	"product_enablement:write",
+	"replay_scanner:read",
+	"replay_scanner:write"
+];
+//#endregion
+//#region src/shared/oauth-scopes.ts
+/**
+* Extra scope the Connect-Slack step needs on top of `WIZARD_OAUTH_SCOPES`.
+*
+* The step polls `/api/projects/:id/integrations/` (`fetchSlackConnected`)
+* to render the already-connected variant and to flip live once the user
+* completes the Slack OAuth step in the browser. Without `integration:read`
+* the first poll 403s, the screen stops polling, and an already-connected
+* project is nagged with the connect nudge. Used by the default integration
+* run (the step ends the run) and by the standalone `wizard slack` flow
+* (the step is the whole program).
+*/
+const CONNECT_SLACK_SCOPE_ADDITIONS = ["integration:read"];
+//#endregion
+//#region src/tools/mcp/scopes.ts
+/**
+* Extra scopes the MCP tutorial needs on top of `WIZARD_OAUTH_SCOPES`.
+*
+* Every scope requested here must stay within the wizard OAuth app's
+* ceiling on the PostHog side (`OAuthApplication.scopes`) — the full
+* list lives in the README under "OAuth app scope ceiling". The
+* tutorial's prompts and follow-ups touch most of the read surface,
+* plus annotation write for the "PostHog wizard install" verify-prompt.
+*
+* Already in the base `WIZARD_OAUTH_SCOPES` (and therefore not
+* repeated here):
+*   • user:read, project:read, llm_gateway:read   — auth + gateway
+*   • query:read                                  — HogQL
+*   • dashboard:write, insight:write, notebook:write  — Phase-5 persist
+*
+* Deliberately omitted (writes on read-only product surfaces):
+*   • feature_flag:write, experiment:write, survey:write,
+*     cohort:write, session_recording:write, error_tracking:write,
+*     alert:write, subscription:write
+*/
+const MCP_TUTORIAL_SCOPE_ADDITIONS = [
+	"dashboard:read",
+	"insight:read",
+	"notebook:read",
+	"feature_flag:read",
+	"experiment:read",
+	"experiment_saved_metric:read",
+	"survey:read",
+	"session_recording:read",
+	"error_tracking:read",
+	"web_analytics:read",
+	"llm_analytics:read",
+	"cohort:read",
+	"person:read",
+	"annotation:read",
+	"annotation:write",
+	"activity_log:read",
+	"property_definition:read",
+	"event_definition:read",
+	"action:read",
+	"warehouse_table:read",
+	"warehouse_view:read",
+	"alert:read",
+	"subscription:read",
+	"integration:read"
+];
+//#endregion
+//#region src/programs/oauth/program-scopes.ts
+/**
+* Extra scopes the warehouse-source program needs on top of
+* `WIZARD_OAUTH_SCOPES`. The agent creates data warehouse sources directly
+* (`external-data-sources-create`) and lists what's connected
+* (`external-data-sources-list`) to verify the result. Both are already within
+* the wizard OAuth app's scope ceiling — the self-driving program requests the
+* same pair.
+*/
+const WAREHOUSE_SOURCE_SCOPE_ADDITIONS = ["external_data_source:read", "external_data_source:write"];
+/**
+* Per-program scope additions, layered on top of `WIZARD_OAUTH_SCOPES`.
+*
+* Programs not listed here request the unchanged base set. Use this
+* map only for programs that need *more* than the base — never for
+* narrowing, since narrowing risks breaking shared infrastructure
+* (e.g. dropping `llm_gateway:read` would 401 every agent call).
+*
+* Keyed by `ProgramId` so TypeScript catches stale entries when a
+* program is renamed or removed.
+*/
+const PROGRAM_SCOPE_ADDITIONS = {
+	"mcp-tutorial": MCP_TUTORIAL_SCOPE_ADDITIONS,
+	"agent-skill": AGENT_SKILL_SCOPE_ADDITIONS,
+	"self-driving": SELF_DRIVING_SCOPE_ADDITIONS,
+	"warehouse-source": WAREHOUSE_SOURCE_SCOPE_ADDITIONS,
+	"posthog-integration": [...CONNECT_SLACK_SCOPE_ADDITIONS, ...WAREHOUSE_SOURCE_SCOPE_ADDITIONS],
+	slack: CONNECT_SLACK_SCOPE_ADDITIONS,
+	"replay-vision": REPLAY_VISION_SCOPE_ADDITIONS
+};
+/**
+* Resolve the OAuth scope list to request for a given program. Returns
+* `WIZARD_OAUTH_SCOPES` for programs without an addition entry; for
+* programs that do have one, returns the union of base + additions
+* with duplicates dropped (declaration order preserved, base first).
+*
+* `null` / `undefined` programId falls through to the default — same
+* behavior as the historical hardcoded `WIZARD_OAUTH_SCOPES` reference
+* in `askForWizardLogin`, so call sites that haven't been updated to
+* pass a programId continue to work unchanged.
+*/
+function getOAuthScopesForProgram(programId) {
+	const additions = programId && PROGRAM_SCOPE_ADDITIONS[programId] || [];
+	if (additions.length === 0) return WIZARD_OAUTH_SCOPES;
+	const seen = /* @__PURE__ */ new Set();
+	const merged = [];
+	for (const s of [...WIZARD_OAUTH_SCOPES, ...additions]) {
+		if (seen.has(s)) continue;
+		seen.add(s);
+		merged.push(s);
 	}
+	return merged;
 }
 /**
-* Warn — at login, while the user is still watching — when the grant came back
-* narrower than the request, and record the gap so narrowed runs are countable.
-* Non-fatal by design: deselecting an optional scope is the user's call, and
-* most flows survive it. The one scope the wizard cannot run without has its
-* own hard check (`assertWizardCompletionScope`).
+* Resolve the scope list for the signup provisioning path. Same
+* base-plus-additions shape as `getOAuthScopesForProgram`, but layered on
+* `WIZARD_PROVISIONING_SCOPES` so a program's extra scopes only reach
+* tokens provisioned for that program.
 */
-function reportNarrowedGrant(requestedScopes, grantedScope) {
-	const missing = missingOAuthScopes(requestedScopes, grantedScope);
-	if (missing.length === 0) return;
-	logToFile(`[oauth] grant narrower than request, missing: ${missing.join(" ")}`);
-	analytics.wizardCapture("oauth grant narrowed", {
-		requested_scopes: [...requestedScopes].sort().join(" "),
-		granted_scopes: parseOAuthScopes(grantedScope).sort().join(" "),
-		missing_scopes: missing.join(" "),
-		missing_scope_count: missing.length
-	});
-	const plural = missing.length > 1;
-	getUI().log.warn(`Your PostHog authorization is missing ${plural ? `${missing.length} permissions` : "a permission"} the wizard asked for: ${missing.join(", ")}. Setup will continue, but steps that need ${plural ? "them" : "it"} may fail. To grant ${plural ? "them" : "it"}, re-run the wizard and approve all permissions on the authorization screen. If that screen does not reappear, revoke the existing PostHog Wizard authorization in your PostHog settings first.`);
-}
-async function performOAuthFlow(config) {
-	const clientId = getOAuthClientId(config.baseUrl);
-	const oauthUrl = getOAuthUrl(config.baseUrl);
-	const codeVerifier = generateCodeVerifier();
-	const codeChallenge = generateCodeChallenge(codeVerifier);
-	let shouldRetry = false;
-	logToFile(`[oauth] starting flow against ${oauthUrl}, requested scopes: ${config.scopes.join(" ")}`);
-	do {
-		shouldRetry = false;
-		let lastProcessInfo = null;
-		for (const port of OAUTH_PORTS) {
-			const callbackUrl = getCallbackUrl(port);
-			const authUrl = new URL(`${oauthUrl}/oauth/authorize`);
-			authUrl.searchParams.set("client_id", clientId);
-			authUrl.searchParams.set("redirect_uri", callbackUrl);
-			authUrl.searchParams.set("response_type", "code");
-			authUrl.searchParams.set("code_challenge", codeChallenge);
-			authUrl.searchParams.set("code_challenge_method", "S256");
-			authUrl.searchParams.set("scope", config.scopes.join(" "));
-			authUrl.searchParams.set("required_access_level", "project");
-			if (config.projectId !== void 0) authUrl.searchParams.set("team_id", String(config.projectId));
-			const taggedAuthUrl = withUtm(authUrl.toString(), "oauth-authorize");
-			const signupUrl = new URL(withUtm(`${oauthUrl}/signup?next=${encodeURIComponent(taggedAuthUrl)}`, "oauth-signup"));
-			const localSignupUrl = getLocalSignupUrl(port);
-			const localLoginUrl = getLocalLoginUrl(port);
-			const urlToOpen = config.signup ? localSignupUrl : localLoginUrl;
-			logToFile(`[oauth] attempting callback server on port ${port}`);
-			let server;
-			let waitForCallback;
-			try {
-				({server, waitForCallback} = await startCallbackServer(taggedAuthUrl, signupUrl.toString(), port));
-			} catch (e) {
-				if (!isPortInUseError(e)) throw e;
-				lastProcessInfo = getPortProcessInfo(port);
-				continue;
-			}
-			logToFile("[oauth] callback server ready, showing login URL");
-			getUI().setLoginUrl(urlToOpen);
-			getUI().setAuthorizeUrl(config.signup ? signupUrl.toString() : taggedAuthUrl);
-			openTrackedLink(urlToOpen, "oauth", {
-				auto: true,
-				skipUtm: true
-			});
-			const loginSpinner = getUI().spinner();
-			loginSpinner.start("Waiting for authorization...");
-			try {
-				const token = await exchangeCodeForToken(await Promise.race([
-					waitForCallback(),
-					getUI().waitForManualAuthCode(),
-					new Promise((_, reject) => setTimeout(() => reject(new Error(AUTHORIZATION_TIMEOUT_MESSAGE)), OAUTH_TIMEOUT_MS))
-				]), codeVerifier, callbackUrl, config.baseUrl);
-				server.close();
-				getUI().setLoginUrl(null);
-				getUI().setAuthorizeUrl(null);
-				loginSpinner.stop("Authorization complete!");
-				reportNarrowedGrant(config.scopes, token.scope);
-				return token;
-			} catch (e) {
-				const error = e instanceof Error ? e : /* @__PURE__ */ new Error("Unknown error");
-				const timedOut = isAuthorizationTimeout(error);
-				const flowError = error instanceof OAuthError ? error : null;
-				loginSpinner.stop(timedOut ? "Session timed out." : "Authorization failed.");
-				server.close();
-				logToFile("[oauth] flow failed:", error);
-				if (flowError?.description) logToFile(`[oauth] server error_description: ${flowError.description}`);
-				const accessDenied = flowError ? flowError.code === "access_denied" : error.message.includes("access_denied");
-				if (timedOut) getUI().showSessionTimeout();
-				else if (accessDenied) getUI().log.info(`Authorization was cancelled.\n\nYou denied access to PostHog. To use the wizard, you need to authorize access to your PostHog account.\n\nYou can try again by re-running the wizard.`);
-				else getUI().log.error(buildOAuthFailureMessage({
-					error,
-					requestedScopes: config.scopes,
-					clientId,
-					oauthUrl,
-					isDevStack: resolveBaseUrl(config.baseUrl) !== void 0
-				}));
-				const oauthErrorCode = flowError ? flowError.code : error.message.startsWith("OAuth error: ") ? error.message.slice(13) : timedOut ? "timeout" : "unknown";
-				analytics.captureException(error, {
-					step: "oauth_flow",
-					oauth_error_code: oauthErrorCode,
-					oauth_error_description: flowError?.description,
-					client_id: clientId,
-					requested_scopes: config.scopes.join(" "),
-					$exception_fingerprint: `wizard_oauth_${oauthErrorCode}`
-				});
-				await abort();
-				throw error;
-			}
-		}
-		if (!lastProcessInfo) throw new Error("No OAuth callback ports configured");
-		await getUI().showPortConflict(lastProcessInfo);
-		shouldRetry = true;
-	} while (shouldRetry);
-	throw new Error("OAuth port retry loop exited unexpectedly");
+function getProvisioningScopesForProgram(programId) {
+	const additions = programId && PROGRAM_SCOPE_ADDITIONS[programId] || [];
+	if (additions.length === 0) return WIZARD_PROVISIONING_SCOPES;
+	const seen = /* @__PURE__ */ new Set();
+	const merged = [];
+	for (const s of [...WIZARD_PROVISIONING_SCOPES, ...additions]) {
+		if (seen.has(s)) continue;
+		seen.add(s);
+		merged.push(s);
+	}
+	return merged;
 }
 //#endregion
 //#region src/shared/utils/project-resolution.ts
@@ -1130,167 +897,27 @@ function resolveGrantedProject(requestedProjectId, scopedTeams) {
 	};
 }
 //#endregion
-//#region src/shared/utils/semver.ts
-/**
-* Version strings from package.json that are not semver ranges.
-* URLs, git refs, dist-tags, local paths, workspace protocol, npm aliases, etc.
-* These should be rejected early — we can't determine a clear version from them.
-*/
-function isNonSemverVersion(version) {
-	const v = version.trim();
-	return v === "" || v.startsWith("http://") || v.startsWith("https://") || v.startsWith("git+") || v.startsWith("git://") || v.startsWith("file:") || v.startsWith("npm:") || v.startsWith("workspace:") || v.startsWith("/") || v.includes("/");
-}
-/**
-* Creates a version bucket function for analytics.
-* Converts versions like "1.2.3" to "1.x" for grouping in analytics.
-*
-* @param minMajorVersion - Optional minimum major version threshold.
-*   Versions below this will be bucketed as "<{min}.0.0"
-*
-* @example
-* const getVersionBucket = createVersionBucket(); // no minimum
-* getVersionBucket("1.2.3") // "1.x"
-*
-* const getVersionBucket = createVersionBucket(11);
-* getVersionBucket("15.3.0") // "15.x"
-* getVersionBucket("10.0.0") // "<11.0.0"
-*/
-function createVersionBucket(minMajorVersion) {
-	return (version) => {
-		if (!version) return "none";
-		if (isNonSemverVersion(version)) return "unknown";
-		try {
-			const minVer = minVersion(version);
-			if (!minVer) return "invalid";
-			const majorVersion = major(minVer);
-			if (minMajorVersion !== void 0 && majorVersion < minMajorVersion) return `<${minMajorVersion}.0.0`;
-			return `${majorVersion}.x`;
-		} catch {
-			return "unknown";
-		}
+//#region src/shared/api-key-login.ts
+async function fetchProjectDataWithApiKey(apiKey, cloudUrl) {
+	const projectId = (await fetchUserData(apiKey, cloudUrl)).team?.id;
+	if (!projectId) throw new Error("Could not determine project ID from API key. Please ensure your API key has access to a project in this cloud region.");
+	const projectData = await fetchProjectData(apiKey, projectId, cloudUrl);
+	return {
+		api_token: projectData.api_token,
+		id: projectId,
+		project: projectData
 	};
 }
-//#endregion
-//#region src/shared/utils/setup-utils.ts
-var setup_utils_exports = /* @__PURE__ */ __exportAll({
-	abort: () => abort,
-	detectOrgAndProject: () => detectOrgAndProject,
-	getOrAskForProjectData: () => getOrAskForProjectData,
-	getPackageDotJson: () => getPackageDotJson,
-	isUsingTypeScript: () => isUsingTypeScript,
-	tryGetPackageJson: () => tryGetPackageJson,
-	updatePackageDotJson: () => updatePackageDotJson
-});
-/** @deprecated Use wizardAbort() directly for new code. */
-async function abort(message, status) {
-	return wizardAbort({
-		message,
-		exitCode: status
-	});
-}
-const FREEMAIL_DOMAINS = new Set([
-	"gmail.com",
-	"googlemail.com",
-	"hotmail.com",
-	"outlook.com",
-	"yahoo.com",
-	"icloud.com",
-	"me.com",
-	"mail.com",
-	"protonmail.com",
-	"proton.me",
-	"live.com",
-	"aol.com",
-	"yandex.com",
-	"zoho.com",
-	"gmx.com",
-	"fastmail.com"
-]);
-function parseGitRemote() {
-	try {
-		const match = childProcess.execSync("git remote get-url origin", { stdio: [
-			"ignore",
-			"pipe",
-			"ignore"
-		] }).toString().trim().match(/[/:]([\w.-]+)\/([\w.-]+?)(?:\.git)?$/);
-		if (match) return {
-			org: match[1],
-			repo: match[2]
-		};
-	} catch {}
-	return null;
-}
-function detectOrgAndProject(email) {
-	const remote = parseGitRemote();
-	const projectName = remote?.repo || basename(process.cwd()) || void 0;
-	let orgName;
-	if (remote?.org) orgName = remote.org;
-	else {
-		const domain = email.split("@")[1]?.toLowerCase();
-		if (domain && !FREEMAIL_DOMAINS.has(domain)) orgName = domain.split(".")[0];
-	}
+async function fetchProjectDataById(apiKey, projectId, cloudUrl) {
+	const projectData = await fetchProjectData(apiKey, projectId, cloudUrl);
 	return {
-		orgName,
-		projectName
+		api_token: projectData.api_token,
+		id: projectId,
+		project: projectData
 	};
 }
-/**
-* Get package.json or abort the wizard if not found.
-* Only use where package.json is required (e.g., package install, overrides).
-* For detection/version-checks, use tryGetPackageJson() instead.
-*/
-async function getPackageDotJson({ installDir }) {
-	const pkgPath = join$1(installDir, "package.json");
-	let raw;
-	try {
-		raw = await fs$1.promises.readFile(pkgPath, "utf8");
-	} catch {
-		getUI().log.error("Could not find package.json. Make sure to run the wizard in the root of your app!");
-		await abort();
-		return {};
-	}
-	try {
-		return JSON.parse(raw) ?? {};
-	} catch {
-		getUI().log.error(`Unable to parse your package.json. Make sure it has a valid format!`);
-		await abort();
-		return {};
-	}
-}
-/**
-* Try to get package.json, returning null if it doesn't exist.
-* Use this for detection purposes where missing package.json is expected (e.g., Python projects).
-*/
-async function tryGetPackageJson({ installDir }) {
-	try {
-		const packageJsonFileContents = await fs$1.promises.readFile(join$1(installDir, "package.json"), "utf8");
-		return JSON.parse(packageJsonFileContents);
-	} catch {
-		return null;
-	}
-}
-async function updatePackageDotJson(packageDotJson, { installDir }) {
-	const pkgPath = join$1(installDir, "package.json");
-	const serialized = JSON.stringify(packageDotJson, null, 2);
-	try {
-		await fs$1.promises.writeFile(pkgPath, serialized, {
-			encoding: "utf8",
-			flag: "w"
-		});
-		return;
-	} catch {
-		getUI().log.error(`Unable to update your package.json.`);
-		await abort();
-	}
-}
-function isUsingTypeScript({ installDir }) {
-	try {
-		fs$1.accessSync(join$1(installDir, "tsconfig.json"));
-		return true;
-	} catch {
-		return false;
-	}
-}
+//#endregion
+//#region src/tui/auth/project-data.ts
 /**
 * Get project data for the wizard via OAuth or CI API key.
 */
@@ -1360,24 +987,6 @@ ${cloudUrl}/settings/project#variables`);
 		missingScopes: missingScopes ?? []
 	};
 }
-async function fetchProjectDataWithApiKey(apiKey, cloudUrl) {
-	const projectId = (await fetchUserData(apiKey, cloudUrl)).team?.id;
-	if (!projectId) throw new Error("Could not determine project ID from API key. Please ensure your API key has access to a project in this cloud region.");
-	const projectData = await fetchProjectData(apiKey, projectId, cloudUrl);
-	return {
-		api_token: projectData.api_token,
-		id: projectId,
-		project: projectData
-	};
-}
-async function fetchProjectDataById(apiKey, projectId, cloudUrl) {
-	const projectData = await fetchProjectData(apiKey, projectId, cloudUrl);
-	return {
-		api_token: projectData.api_token,
-		id: projectId,
-		project: projectData
-	};
-}
 async function askForWizardLogin(options) {
 	if (options.signup) return askForProvisioningSignup(options.email, options.region, options.baseUrl, options.localMcp, options.programId);
 	const requestedScopes = [...getOAuthScopesForProgram(options.programId)];
@@ -1517,6 +1126,6 @@ async function askForProvisioningSignup(email, region, baseUrl, localMcp, progra
 	}
 }
 //#endregion
-export { createVersionBucket as a, refreshAccessToken as c, mcpUrlFor as d, detectAllPackageManagers as f, tryGetPackageJson as i, OAuthError as l, isUsingTypeScript as n, extractOAuthCode as o, detectNodePackageManagers as p, setup_utils_exports as r, missingOAuthScopes as s, getOrAskForProjectData as t, HostResolution as u };
+export { OAuthError as a, refreshAccessToken as i, extractOAuthCode as n, missingOAuthScopes as r, getOrAskForProjectData as t };
 
-//# sourceMappingURL=setup-utils-dCViCC6s.js.map
+//# sourceMappingURL=project-data-BO9IXn9y.js.map